{"id":"CVE-2016-10130","aliases":["ALPINE-CVE-2016-10130","DEBIAN-CVE-2016-10130","EUVD-2016-1320","GHSA-fhf3-77x2-3mpp","SUSE-SU-2017:0433-1","UBUNTU-CVE-2016-10130","openSUSE-SU-2017:0405-1","openSUSE-SU-2024:10943-1"],"status":"published","title":"The http_connect function in transports/http.c in libgit2 before 0.24.6 and 0.25.x before 0.25.1...","description":"The http_connect function in transports/http.c in libgit2 before 0.24.6 and 0.25.x before 0.25.1 might allow man-in-the-middle attackers to spoof servers by leveraging clobbering of the error variable.","severity":{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.01724,"percentile":0.77673,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-284"],"published":"2017-02-06T12:58:42Z","modified":"2026-10-20T13:13:29Z","fixes":[{"ecosystem":"Alpine:v3.10","package":"libgit2","fixed_in":["0.25.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"libgit2","fixed_in":["0.25.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.4","package":"libgit2","fixed_in":["0.24.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.5","package":"libgit2","fixed_in":["0.24.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.6","package":"libgit2","fixed_in":["0.25.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.7","package":"libgit2","fixed_in":["0.25.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.8","package":"libgit2","fixed_in":["0.25.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.9","package":"libgit2","fixed_in":["0.25.1-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"cargo","fixed_in":["0.17.0-1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"libgit2","fixed_in":["0.25.1+really0.24.6-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libgit2","fixed_in":["0.25.1+really0.24.6-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libgit2","fixed_in":["0.25.1+really0.24.6-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libgit2","fixed_in":["0.24.1-2ubuntu0.2+esm3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.10","package":"libgit2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.25.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"libgit2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.25.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.4","package":"libgit2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.24.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.5","package":"libgit2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.24.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.6","package":"libgit2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.25.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.7","package":"libgit2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.25.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.8","package":"libgit2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.25.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.9","package":"libgit2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.25.1-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"cargo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.17.0-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libgit2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.25.1+really0.24.6-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"libgit2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.25.1+really0.24.6-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libgit2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.25.1+really0.24.6-1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP2","package":"libgit2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.24.1-6.1"}]}],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libgit2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.24.1-2ubuntu0.2+esm3"}]}],"versions":["0.22.2-2","0.23.1-1","0.24.1-2","0.24.1-2ubuntu0.2","0.24.1-2ubuntu0.2+esm1","0.24.1-2ubuntu0.2+esm2"]},{"source":"osv","ecosystem":"SUSE:Package Hub 12 SP1","package":"libgit2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.24.6-10.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"libgit2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1-1.2"}]}],"bundled":15}],"products":[{"vendor":"libgit2_project","product":"libgit2"}],"references":[{"url":"https://libgit2.github.com/security/","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory","fix"]},{"url":"http://www.openwall.com/lists/oss-security/2017/01/10/5","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Patch","Third Party Advisory","fix"]},{"url":"http://www.openwall.com/lists/oss-security/2017/01/11/6","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Patch","Third Party Advisory","fix"]},{"url":"http://www.securityfocus.com/bid/95359","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"https://github.com/libgit2/libgit2/commit/9a64e62f0f20c9cf9b2e1609f037060eb2d8eb22","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Patch","Third Party Advisory","fix","report"]},{"url":"http://lists.opensuse.org/opensuse-updates/2017-02/msg00030.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Third Party Advisory","advisory"]},{"url":"http://lists.opensuse.org/opensuse-updates/2017-02/msg00036.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Third Party Advisory","advisory"]},{"url":"https://github.com/libgit2/libgit2/commit/b5c6a1b407b7f8b952bded2789593b68b1876211","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Patch","Third Party Advisory","fix"]},{"url":"http://lists.opensuse.org/opensuse-updates/2017-02/msg00072.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-10130"},{"url":"https://libgit2.github.com/security"},{"url":"https://github.com/advisories/GHSA-fhf3-77x2-3mpp"},{"url":"https://security.alpinelinux.org/vuln/CVE-2016-10130","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2016-10130","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20170433-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1019036","tags":["report"]},{"url":"https://bugzilla.suse.com/1019037","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10128","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10129","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10130","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5338","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5339","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2016-10130","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-10130","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8628-1","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2005-4900","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-10887","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-11235","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-17456","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-8098","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-1348","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-1349","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-1350","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-1351","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-1352","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-1353","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-1354","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-1387","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2016-10130","description":"The http_connect function in transports/http.c in libgit2 before 0.24.6 and 0.25.x before 0.25.1 might allow man-in-the-middle attackers to spoof servers by leveraging clobbering of the error variable.","status":"published","published":"2017-03-24T15:00:00Z","modified":"2024-08-06T03:14:41.339Z","updated_at":"2026-11-02T14:33:31.117878Z"}],"euvd":[{"id":"EUVD-2016-1320","description":"The http_connect function in transports/http.c in libgit2 before 0.24.6 and 0.25.x before 0.25.1 might allow man-in-the-middle attackers to spoof servers by leveraging clobbering of the error variable.","status":"published","published":"2017-03-24T15:00:00Z","modified":"2024-08-06T03:14:41Z","updated_at":"2026-11-03T02:22:24.738409Z"}],"ghsa":[{"id":"GHSA-fhf3-77x2-3mpp","title":"The http_connect function in transports/http.c in libgit2 before 0.24.6 and 0.25.x before 0.25.1...","description":"The http_connect function in transports/http.c in libgit2 before 0.24.6 and 0.25.x before 0.25.1 might allow man-in-the-middle attackers to spoof servers by leveraging clobbering of the error variable.","status":"published","published":"2022-05-17T02:53:26Z","modified":"2025-04-20T03:35:49Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T15:01:43.480751Z"}],"nvd":[{"id":"CVE-2016-10130","description":"The http_connect function in transports/http.c in libgit2 before 0.24.6 and 0.25.x before 0.25.1 might allow man-in-the-middle attackers to spoof servers by leveraging clobbering of the error variable.","status":"published","published":"2017-03-24T15:59:00.263Z","modified":"2026-06-17T00:39:06.913Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:03:37.238712Z"}],"osv":[{"id":"ALPINE-CVE-2016-10130","description":"The http_connect function in transports/http.c in libgit2 before 0.24.6 and 0.25.x before 0.25.1 might allow man-in-the-middle attackers to spoof servers by leveraging clobbering of the error variable.","status":"published","published":"2017-03-24T15:59:00.263Z","modified":"2026-09-22T06:30:18.307573329Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:27:46.318571Z"},{"id":"CVE-2016-10130","description":"The http_connect function in transports/http.c in libgit2 before 0.24.6 and 0.25.x before 0.25.1 might allow man-in-the-middle attackers to spoof servers by leveraging clobbering of the error variable.","status":"published","published":"2017-03-24T15:59:00.263Z","modified":"2026-10-20T13:13:29.902095613Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:01.531338Z"},{"id":"DEBIAN-CVE-2016-10130","description":"The http_connect function in transports/http.c in libgit2 before 0.24.6 and 0.25.x before 0.25.1 might allow man-in-the-middle attackers to spoof servers by leveraging clobbering of the error variable.","status":"published","published":"2017-03-24T15:59:00.263Z","modified":"2026-09-22T07:01:18.373897467Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:27.323751Z"},{"id":"UBUNTU-CVE-2016-10130","description":"The http_connect function in transports/http.c in libgit2 before 0.24.6 and 0.25.x before 0.25.1 might allow man-in-the-middle attackers to spoof servers by leveraging clobbering of the error variable.","status":"published","published":"2017-03-24T15:59:00Z","modified":"2026-08-13T19:30:27.204306723Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:11.492576Z"},{"id":"openSUSE-SU-2017:0405-1","title":"Security update for libgit2","description":"\nThis update for libgit2 to version 0.24.6 fixes the following issues:\n\n- CVE-2016-10130: When using the custom certificate callback or when using pygit2 or git2go a attacker could have caused an invalid certificate to be accepted (bsc#1019037).\n- CVE-2017-5338: When using the custom certificate callback or when using pygit2 or git2go a attacker could have caused an invalid certificate to be accepted (bsc#1019037).\n- CVE-2017-5339: When using the custom certificate callback or when using pygit2 or git2go a attacker could have caused an invalid certificate to be accepted (bsc#1019037).\n- CVE-2016-10128: Additional sanitization prevent some edge cases in the Git Smart Protocol which can lead to reading outside of a buffer (bsc#1019036).\n- CVE-2016-10129: Additional sanitization prevent some edge cases in the Git Smart Protocol which can lead to reading outside of a buffer (bsc#1019036).\n","status":"published","published":"2017-02-06T12:58:42Z","modified":"2026-02-04T03:25:29.248978Z","updated_at":"2026-11-02T16:58:30.39372Z"},{"id":"openSUSE-SU-2024:10943-1","title":"libgit2-1_1-1.1.1-1.2 on GA media","description":"These are all security issues fixed in the libgit2-1_1-1.1.1-1.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:59:38.45631Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"SUSE-SU-2017:0433-1","title":"Security update for libgit2","description":"\nThis update for libgit2 fixes the several issues.\n\nThese security issues were fixed:\n\n- CVE-2016-10130: When using the custom certificate callback or when using pygit2 or git2go a attacker could have caused an invalid certificate to be accepted (bsc#1019037).\n- CVE-2017-5338: When using the custom certificate callback or when using pygit2 or git2go a attacker could have caused an invalid certificate to be accepted (bsc#1019037).\n- CVE-2017-5339: When using the custom certificate callback or when using pygit2 or git2go a attacker could have caused an invalid certificate to be accepted (bsc#1019037).\n- CVE-2016-10128: Additional sanitization prevent some edge cases in the Git Smart Protocol which can lead to reading outside of a buffer (bsc#1019036).\n- CVE-2016-10129: Additional sanitization prevent some edge cases in the Git Smart Protocol which can lead to reading outside of a buffer (bsc#1019036).\n","status":"published","published":"2017-02-09T10:17:43Z","modified":"2026-02-04T02:18:28.648866Z","updated_at":"2026-11-02T15:53:43.83457Z"}]}}